Concatenate 2 fields separated by a "-" in PHP

Question

I am using PHPRunner and I am adding code to an event which will concatenate the 2 fields "AgentID" and "Client ID" separated by a "-". The code runs after the record has been added to the database. The code is being written inside php code and not in MySQL. My question is, What is the correct code to use as a sql statement inside php code that will accomplish this. I do not need connection portion of code.

I am using something like

$sql = "UPDATE Contacts SET GenClientId = '$AgentID."-".$ClientID' WHERE ClientID = '$ClientID'";
    $result=$conn->query($sql);

And I am not getting the results I need.

Answer 1

You can put vars in double quotes. Array items need a bit more formatting.

$sql = "UPDATE Contacts SET GenClientId = '$AgentID-$ClientID' WHERE ClientID = '$ClientID'";
  $result=$conn->query($sql);

You are wide open to SQL injection.

https://bobby-tables.com/php -- for some help on prepared statements.

Answer 2

I would suggest to use Prepared Statements in order to avoid SQL injection possibility.

$stmt = $conn->prepare('UPDATE Contacts SET GenClientId = ? WHERE ClientID = ?');
$stmt->bind_param('si', $AgentID . '-' . $ClientID, $ClientID);
$stmt->execute();